e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher/*
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher SSSD
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher Authors:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher Stephen Gallagher <sgallagh@redhat.com>
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher Copyright (C) 2011 Red Hat
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher This program is free software; you can redistribute it and/or modify
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher it under the terms of the GNU General Public License as published by
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher the Free Software Foundation; either version 3 of the License, or
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher (at your option) any later version.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher This program is distributed in the hope that it will be useful,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher but WITHOUT ANY WARRANTY; without even the implied warranty of
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher GNU General Public License for more details.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher You should have received a copy of the GNU General Public License
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher along with this program. If not, see <http://www.gnu.org/licenses/>.
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher*/
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "util/util.h"
21909d3b620d97e81dd946b959a47efe88d2b7d8Fabiano Fidêncio#include "providers/ipa/ipa_rules_common.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "providers/ipa/ipa_hbac_private.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher#include "providers/ldap/sdap_async.h"
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstruct ipa_hbac_service_state {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct tevent_context *ev;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sdap_handle *sh;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sdap_options *opts;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char **attrs;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny char *service_filter;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny char *cur_filter;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sdap_search_base **search_bases;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny int search_base_iter;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Return values */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t service_count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sysdb_attrs **services;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t servicegroup_count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sysdb_attrs **servicegroups;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher};
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenystatic errno_t
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenyipa_hbac_service_info_next(struct tevent_req *req,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct ipa_hbac_service_state *state);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstatic void
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_service_info_done(struct tevent_req *subreq);
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenystatic errno_t
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenyipa_hbac_servicegroup_info_next(struct tevent_req *req,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct ipa_hbac_service_state *state);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstatic void
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_servicegroup_info_done(struct tevent_req *subreq);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstruct tevent_req *
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_service_info_send(TALLOC_CTX *mem_ctx,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct tevent_context *ev,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sdap_handle *sh,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sdap_options *opts,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sdap_search_base **search_bases)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ipa_hbac_service_state *state;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct tevent_req *req;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher char *service_filter;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher req = tevent_req_create(mem_ctx, &state, struct ipa_hbac_service_state);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (req == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create failed.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->ev = ev;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->sh = sh;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->opts = opts;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->search_bases = search_bases;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->search_base_iter = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher service_filter = talloc_asprintf(state, "(objectClass=%s)",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher IPA_HBAC_SERVICE);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (service_filter == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto immediate;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->service_filter = service_filter;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->cur_filter = NULL;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs = talloc_array(state, const char *, 6);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (state->attrs == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Failed to allocate service attribute list.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto immediate;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[0] = OBJECTCLASS;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[1] = IPA_CN;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[2] = IPA_UNIQUE_ID;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[3] = IPA_MEMBER;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[4] = IPA_MEMBEROF;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->attrs[5] = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = ipa_hbac_service_info_next(req, state);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret == EOK) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = EINVAL;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret != EAGAIN) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto immediate;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return req;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherimmediate:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_done(req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher } else {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_error(req, ret);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_post(req, ev);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return req;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenystatic errno_t ipa_hbac_service_info_next(struct tevent_req *req,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct ipa_hbac_service_state *state)
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny{
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct tevent_req *subreq;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sdap_search_base *base;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny base = state->search_bases[state->search_base_iter];
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (base == NULL) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EOK;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny talloc_zfree(state->cur_filter);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->cur_filter = sdap_combine_filters(state, state->service_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina base->filter);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (state->cur_filter == NULL) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return ENOMEM;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Sending request for next search base: "
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny "[%s][%d][%s]\n", base->basedn, base->scope,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->cur_filter);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny base->basedn, base->scope,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->cur_filter,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->attrs, NULL, 0,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny dp_opt_get_int(state->opts->basic,
2f3ee3f49019f5b60adbe073070f31e6e2d7c7abStephen Gallagher SDAP_ENUM_SEARCH_TIMEOUT),
2f3ee3f49019f5b60adbe073070f31e6e2d7c7abStephen Gallagher true);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Error requesting service info\n");
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EIO;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny tevent_req_set_callback(subreq, ipa_hbac_service_info_done, req);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EAGAIN;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny}
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstatic void
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_service_info_done(struct tevent_req *subreq)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct tevent_req *req =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_callback_data(subreq, struct tevent_req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ipa_hbac_service_state *state =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_data(req, struct ipa_hbac_service_state);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher char *servicegroup_filter;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = sdap_get_generic_recv(subreq, state,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &state->service_count,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &state->services);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_zfree(subreq);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK && ret != ENOENT) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == ENOENT || state->service_count == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* If there are no services, we'll shortcut out
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * This is still valid, as rules can apply to
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * all services
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher * There's no reason to try to process groups
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->search_base_iter++;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = ipa_hbac_service_info_next(req, state);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret == EAGAIN) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->service_count = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->services = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = replace_attribute_name(IPA_MEMBEROF, SYSDB_ORIG_MEMBEROF,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->service_count,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher state->services);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Could not replace attribute names\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher servicegroup_filter = talloc_asprintf(state, "(objectClass=%s)",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher IPA_HBAC_SERVICE_GROUP);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (servicegroup_filter == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny talloc_zfree(state->service_filter);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->service_filter = servicegroup_filter;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->search_base_iter = 0;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = ipa_hbac_servicegroup_info_next(req, state);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret == EOK) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = EINVAL;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret != EAGAIN) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherdone:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_done(req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher } else {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_error(req, ret);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenystatic errno_t
71ad247500b417836a1a2edec257a4433a7c415fJan Zelenyipa_hbac_servicegroup_info_next(struct tevent_req *req,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct ipa_hbac_service_state *state)
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny{
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct tevent_req *subreq;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sdap_search_base *base;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny base = state->search_bases[state->search_base_iter];
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (base == NULL) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EOK;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny talloc_zfree(state->cur_filter);
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina state->cur_filter = sdap_combine_filters(state, state->service_filter,
92ec40e6aa25f75903ffdb166a8ec56b67bfd77dPavel Březina base->filter);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (state->cur_filter == NULL) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return ENOMEM;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny /* Look up service groups */
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_TRACE_FUNC, "Sending request for next search base: "
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny "[%s][%d][%s]\n", base->basedn, base->scope,
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov state->cur_filter);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny subreq = sdap_get_generic_send(state, state->ev, state->opts, state->sh,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny base->basedn, base->scope,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->cur_filter, state->attrs, NULL, 0,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny dp_opt_get_int(state->opts->basic,
2f3ee3f49019f5b60adbe073070f31e6e2d7c7abStephen Gallagher SDAP_ENUM_SEARCH_TIMEOUT),
2f3ee3f49019f5b60adbe073070f31e6e2d7c7abStephen Gallagher true);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (subreq == NULL) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Error requesting servicegroup info\n");
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EIO;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny tevent_req_set_callback(subreq, ipa_hbac_servicegroup_info_done, req);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return EAGAIN;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny}
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherstatic void
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_servicegroup_info_done(struct tevent_req *subreq)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct tevent_req *req =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_callback_data(subreq, struct tevent_req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ipa_hbac_service_state *state =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_data(req, struct ipa_hbac_service_state);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny size_t total_count;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny size_t group_count;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sysdb_attrs **groups;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sysdb_attrs **target;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny int i;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = sdap_get_generic_recv(subreq, state,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny &group_count,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny &groups);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_zfree(subreq);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (group_count > 0) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = replace_attribute_name(IPA_MEMBER, SYSDB_ORIG_MEMBER,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny group_count,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny groups);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Could not replace attribute names\n");
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny goto done;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = replace_attribute_name(IPA_MEMBEROF, SYSDB_ORIG_MEMBEROF,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->servicegroup_count,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->servicegroups);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret != EOK) {
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Could not replace attribute names\n");
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny goto done;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny total_count = state->servicegroup_count + group_count;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->servicegroups = talloc_realloc(state, state->servicegroups,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny struct sysdb_attrs *,
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny total_count);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (state->servicegroups == NULL) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = ENOMEM;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny goto done;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny i = 0;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny while (state->servicegroup_count < total_count) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny target = &state->servicegroups[state->servicegroup_count];
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny *target = talloc_steal(state->servicegroups, groups[i]);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->servicegroup_count++;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny i++;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny state->search_base_iter++;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny ret = ipa_hbac_servicegroup_info_next(req, state);
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny if (ret == EAGAIN) {
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny return;
71ad247500b417836a1a2edec257a4433a7c415fJan Zeleny } else if (ret != EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherdone:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_done(req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher } else {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_MINOR_FAILURE, "Error [%d][%s]\n", ret, strerror(ret));
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_error(req, ret);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallaghererrno_t
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagheripa_hbac_service_info_recv(struct tevent_req *req,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher TALLOC_CTX *mem_ctx,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t *service_count,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sysdb_attrs ***services,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t *servicegroup_count,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sysdb_attrs ***servicegroups)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t c;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ipa_hbac_service_state *state =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tevent_req_data(req, struct ipa_hbac_service_state);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher TEVENT_REQ_RETURN_ON_ERROR(req);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *service_count = state->service_count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *services = talloc_steal(mem_ctx, state->services);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher for (c = 0; c < state->service_count; c++) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Guarantee the memory heirarchy of the list */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_steal(state->services, state->services[c]);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *servicegroup_count = state->servicegroup_count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *servicegroups = talloc_steal(mem_ctx, state->servicegroups);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallaghererrno_t
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherhbac_service_attrs_to_rule(TALLOC_CTX *mem_ctx,
770896b194b7b66b09c2a30545b4d091fd86b1f4Simo Sorce struct sss_domain_info *domain,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *rule_name,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct sysdb_attrs *rule_attrs,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct hbac_rule_element **services)
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher{
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher errno_t ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher TALLOC_CTX *tmp_ctx;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct hbac_rule_element *new_services;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *attrs[] = { IPA_CN, NULL };
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ldb_message_element *el;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t num_services = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t num_servicegroups = 0;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t i;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher char *member_dn;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher char *filter;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher size_t count;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher struct ldb_message **msgs;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *name;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_LIBS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Processing PAM services for rule [%s]\n", rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher tmp_ctx = talloc_new(mem_ctx);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (tmp_ctx == NULL) return ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services = talloc_zero(tmp_ctx, struct hbac_rule_element);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* First check for service category */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = hbac_get_category(rule_attrs, IPA_SERVICE_CATEGORY,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &new_services->category);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Could not identify service categories\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->category & HBAC_CATEGORY_ALL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Short-cut to the exit */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Get the list of DNs from the member attr */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = sysdb_attrs_get_el(rule_attrs, IPA_MEMBER_SERVICE, &el);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK && ret != ENOENT) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "sysdb_attrs_get_el failed.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == ENOENT || el->num_values == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher el->num_values = 0;
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CONF_SETTINGS,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "No services specified, rule will never apply.\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Assume maximum size; We'll trim it later */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->names = talloc_array(new_services,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher el->num_values +1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->names == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->groups = talloc_array(new_services,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher el->num_values + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->groups == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher for (i = 0; i < el->num_values; i++) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = sss_filter_sanitize(tmp_ctx,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher (const char *)el->values[i].data,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher filter = talloc_asprintf(member_dn, "(%s=%s)",
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher SYSDB_ORIG_DN, member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (filter == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* First check if this is a specific service */
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_search_custom(tmp_ctx, domain, filter,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher HBAC_SERVICES_SUBDIR, attrs,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &count, &msgs);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK && ret != ENOENT) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK && count == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOENT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (count > 1) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Original DN matched multiple services. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Skipping \n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher continue;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Original DN matched a single service. Get the service name */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher name = ldb_msg_find_attr_as_string(msgs[0], IPA_CN, NULL);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Attribute is missing!\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = EFAULT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->names[num_services] =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_strdup(new_services->names, name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->names[num_services] == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL, "Added service [%s] to rule [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name, rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher num_services++;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher } else { /* ret == ENOENT */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Check if this is a service group */
d115f40c7a3999e3cbe705a2ff9cf0fd493f80fbMichal Zidek ret = sysdb_search_custom(tmp_ctx, domain, filter,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher HBAC_SERVICEGROUPS_SUBDIR, attrs,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher &count, &msgs);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret != EOK && ret != ENOENT) goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK && count == 0) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOENT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (count > 1) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Original DN matched multiple service groups. "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "Skipping\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher continue;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Original DN matched a single group. Get the groupname */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher name = ldb_msg_find_attr_as_string(msgs[0], IPA_CN, NULL);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (name == NULL) {
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE, "Attribute is missing!\n");
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = EFAULT;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->groups[num_servicegroups] =
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_strdup(new_services->groups, name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->groups[num_servicegroups] == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_TRACE_INTERNAL,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "Added service group [%s] to rule [%s]\n",
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov name, rule_name);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher num_servicegroups++;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher } else { /* ret == ENOENT */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Neither a service nor a service group? Skip it */
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov DEBUG(SSSDBG_CRIT_FAILURE,
83bf46f4066e3d5e838a32357c201de9bd6ecdfdNikolai Kondrashov "[%s] does not map to either a service or "
a3c8390d19593b1e5277d95bfb4ab206d4785150Nikolai Kondrashov "service group. Skipping\n", member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_zfree(member_dn);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->names[num_services] = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->groups[num_servicegroups] = NULL;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher /* Shrink the arrays down to their real sizes */
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->names = talloc_realloc(new_services, new_services->names,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *, num_services + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->names == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher new_services->groups = talloc_realloc(new_services, new_services->groups,
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher const char *, num_servicegroups + 1);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (new_services->groups == NULL) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = ENOMEM;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher goto done;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher ret = EOK;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagherdone:
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher if (ret == EOK) {
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher *services = talloc_steal(mem_ctx, new_services);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher }
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher talloc_free(tmp_ctx);
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher return ret;
e134a6af42102c8d865e82bf89e0b8c5a40fb5faStephen Gallagher}
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallaghererrno_t
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagherget_ipa_servicegroupname(TALLOC_CTX *mem_ctx,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher struct sysdb_ctx *sysdb,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const char *service_dn,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher char **servicegroupname)
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher{
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher errno_t ret;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher struct ldb_dn *dn;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const char *rdn_name;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const char *svc_comp_name;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const char *hbac_comp_name;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const struct ldb_val *rdn_val;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const struct ldb_val *svc_comp_val;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher const struct ldb_val *hbac_comp_val;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* This is an IPA-specific hack. It may not
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher * work for non-IPA servers and will need to
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher * be changed if SSSD ever supports HBAC on
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher * a non-IPA server.
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher *servicegroupname = NULL;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher dn = ldb_dn_new(mem_ctx, sysdb_ctx_get_ldb(sysdb), service_dn);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (dn == NULL) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher ret = ENOMEM;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (!ldb_dn_validate(dn)) {
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_MALFORMED_ENTRY;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (ldb_dn_get_comp_num(dn) < 4) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* RDN, services, hbac, and at least one DC= */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* If it's fewer, it's not a group DN */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* If the RDN name is 'cn' */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher rdn_name = ldb_dn_get_rdn_name(dn);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (rdn_name == NULL) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* Shouldn't happen if ldb_dn_validate()
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher * passed, but we'll be careful.
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_MALFORMED_ENTRY;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (strcasecmp("cn", rdn_name) != 0) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* RDN has the wrong attribute name.
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher * It's not a service.
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* and the second component is "cn=hbacservicegroups" */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher svc_comp_name = ldb_dn_get_component_name(dn, 1);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (strcasecmp("cn", svc_comp_name) != 0) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* The second component name is not "cn" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher svc_comp_val = ldb_dn_get_component_val(dn, 1);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (strncasecmp("hbacservicegroups",
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher (const char *) svc_comp_val->data,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher svc_comp_val->length) != 0) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* The second component value is not "hbacservicegroups" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* and the third component is "hbac" */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher hbac_comp_name = ldb_dn_get_component_name(dn, 2);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (strcasecmp("cn", hbac_comp_name) != 0) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* The third component name is not "cn" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher hbac_comp_val = ldb_dn_get_component_val(dn, 2);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (strncasecmp("hbac",
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher (const char *) hbac_comp_val->data,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher hbac_comp_val->length) != 0) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* The third component value is not "hbac" */
1243e093fd31c5660adf1bb3dd477d6935a755beJakub Hrozek ret = ERR_UNEXPECTED_ENTRY_TYPE;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher /* Then the value of the RDN is the group name */
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher rdn_val = ldb_dn_get_rdn_val(dn);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher *servicegroupname = talloc_strndup(mem_ctx,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher (const char *)rdn_val->data,
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher rdn_val->length);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher if (*servicegroupname == NULL) {
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher ret = ENOMEM;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher goto done;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher }
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher ret = EOK;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagherdone:
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher talloc_free(dn);
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher return ret;
f5e22261a2ff95f2a61f4f199fffb8de79668110Stephen Gallagher}